Apparatus and method for cache locking based on row hammering

Abstract

Devices, systems, and methods for row-based cache locking. The memory controller may include intruder detector circuitry that determines whether an address is an intruder address. The controller may include tracker circuitry that counts the number of times an address is identified as an intruder and determines, based on the count, whether the intruder address is a frequent intruder address. If the address is a frequent intruder address, then cache entries associated with the frequent intruder address may be locked (e.g., for a set amount of time). In some embodiments, the controller may include a second tracker that determines whether the frequent intruder address is a high-attack address. The address mapping associated with the high-attack address may be modified.

Description

Technical Field

[0001] This disclosure generally relates to semiconductor devices, and more specifically, to semiconductor memory devices. Background Technology

[0002] Specifically, this disclosure relates to volatile memory, such as dynamic random access memory (DRAM). Information may be stored as physical signals in individual memory cells (e.g., charges on capacitive elements). The memory may be volatile, and the physical signals may decay over time (which may degrade or destroy the information stored in the memory cells). It may be necessary to periodically refresh the information in the memory cells by, for example, rewriting the information to restore the physical signals to their initial values.

[0003] As the size of memory components decreases, the density of memory cells increases significantly. Various access patterns to specific memory cells or groups of memory cells (often referred to as attacks) can lead to an increased rate of data degradation in neighboring memory cells. As part of a targeted refresh operation, memory cells affected by an attack can be identified and refreshed. The memory controller and / or the memory itself can track access patterns to various memory addresses to determine if they are involved in an attack, making them refreshable. However, taking additional actions after the refresh to mitigate data degradation can be useful. Summary of the Invention

[0004] One embodiment of this disclosure provides an apparatus comprising: a processor configured to provide an address to memory and receive data associated with the address; logic configured to identify a row of memory associated with a specific address, change a count value associated with the specific address, and determine, based on the count value, that the row of memory associated with the specific address has been activated at least a threshold number of times; and a cache configured to store the data associated with the specific address and configured to manage the stored data in the cache at least in part based on the number of times the row has been activated at least a threshold number of times.

[0005] Another embodiment of this disclosure provides a system including: a memory; and a controller configured to operate the memory, the controller including: a processor configured to provide an address as part of an access operation; logic configured to identify a row of memory associated with a specific address and change a count value associated with the specific address, and determine based on the count value that the row of memory associated with the specific address has been activated at least a threshold number of times; and a cache configured to store data associated with the specific address retrieved from the memory, and configured to manage the stored data in the cache at least in part based on the number of times the row has been activated at least a threshold number of times.

[0006] Another embodiment of this disclosure provides a method comprising: identifying a row of memory associated with a specific address; comparing the specific address with a plurality of stored addresses and changing a count value in part based on the comparison; determining, in part based on the count value, whether the row of memory has been accessed at least a threshold number of times; and managing cache entries associated with the specific address in part based on the determination that the row of memory has been accessed at least the threshold number of times. Attached Figure Description

[0007] Figure 1 This is a block diagram of a memory system according to some embodiments of the present disclosure.

[0008] Figure 2 This is a block diagram of a semiconductor device according to an embodiment of the present disclosure.

[0009] Figure 3 This is a block diagram of the hammering logic according to some embodiments of the present disclosure.

[0010] Figure 4 This is a block diagram of a cache and cache logic according to some embodiments of the present disclosure.

[0011] Figure 5 This is a block diagram of a method according to some embodiments of the present disclosure. Detailed Implementation

[0012] The following description of certain embodiments is exemplary in nature and is in no way intended to limit the scope of this disclosure or its application or use. In the following detailed description of embodiments of the systems and methods of the invention, reference is made to the accompanying drawings, which form a part of this document, and to specific embodiments of the described systems and methods shown in the illustrations. These embodiments are described in sufficient detail to enable those skilled in the art to practice the currently disclosed systems and methods, and it should be understood that other embodiments may be utilized, and structural and logical changes may be made without departing from the spirit and scope of this disclosure. Furthermore, for clarity, detailed descriptions of certain features will not be elaborated where they would be obvious to those skilled in the art, so as not to obscure the description of embodiments of this disclosure. Therefore, the following detailed description should not be construed in a limiting sense, and the scope of this disclosure is limited only by the appended claims.

[0013] Information in volatile memory devices can be stored in memory cells (e.g., as charge on capacitive elements) and can decay over time. In each bank of a memory array, memory cells can be organized into rows (word lines) and columns (bit lines). Memory cells can be refreshed on a row-by-row basis. To prevent information loss or corruption due to this decay, the memory can implement a background refresh process, such as an automatic refresh operation as part of a self-refresh mode. During the refresh operation, information can be rewritten to the word lines to restore its initial state. Automatic refresh operations can be performed on the word lines of memory in a sequence, such that the word lines of memory are refreshed over time at a rate faster than the expected data degradation rate.

[0014] For example, various attack patterns involving repeated access to specific rows of memory (e.g., the attacker row) may cause an increased decay rate in adjacent rows (e.g., the victim row) due to factors such as electromagnetic coupling between rows. These repeated access patterns can be termed 'row hammering'. These repeated accesses may be part of an intentional attack against the memory and / or may be attributable to the memory's 'natural' access patterns. Row hammering attacks can cause information to decay more rapidly in the victim row compared to the rate at which automatic refresh operations can refresh the victim row. Therefore, it may be necessary to monitor the attacker row so that steps can be taken to mitigate or repair the damage before information is lost in the victim row.

[0015] The memory controller tracks accesses to different rows to determine which rows are intruders. Intruder detector circuitry can use one or more schemes to determine if a given address is an intruder. For example, the intruder detector can determine if a given row has been accessed more than a threshold number of times (or at a threshold rate) and / or can directly inspect for errors in the victim row (e.g., using error correction circuitry). Various steps can be used to prevent and / or repair damage to the victim row. For example, a targeted refresh operation can be performed to refresh the identified victim. However, a targeted refresh operation can consume power and / or take time that might have been used for other operations. Therefore, it may be necessary to mitigate attack damage through other methods (e.g., replacing or supplementing the targeted refresh operation).

[0016] This disclosure depicts apparatus, systems, and methods for row-hammer-based cache locking. A controller (and / or memory) may include a cache. The set of most recently accessed data from memory may be stored in the cache, allowing for faster access to recently accessed information. Information stored in the cache may be less susceptible to row-hammer effects (or may be less affected). The controller may include logic that determines the number (and / or rate) of accesses to an identified row (e.g., an aggressor row) of memory. If the number (and / or rate) exceeds a first threshold, the controller may manage entries in the cache associated with the address associated with the identified row. For example, the cache may be managed in a manner that ensures data associated with the identified row remains in the cache for at least a minimum amount of time.

[0017] In an example embodiment, the controller may include row hammering logic that counts the number of times an address is identified as an aggressor. When the count exceeds a threshold (which may represent at least a threshold number of row accesses associated with the aggressor address), the data associated with the aggressor address may be 'locked' so that the data does not leave the cache even if the cache logic would otherwise retrieve the data from the cache. Therefore, although it remains locked in the cache, access to the aggressor address can actually access the information in the cache. This reduces access to the memory array and reduces the impact of row hammering (e.g., by allowing time for refreshing the victim word line, as part of an automatic refresh operation).

[0018] In some embodiments, if the row hammering tracker determines that an aggressor is being hammered frequently (e.g., accessed more than a second threshold number of times), the controller may take additional steps. In addition to locking the data in a cache, the controller may remap the physical word line associated with the aggressor address. For example, if the aggressor address is associated with a first word line, the controller may remap the word line such that the aggressor address is now associated with a second word line that is far from the first word line. This ensures that the victim (e.g., the row closest to the first word line) is now far from the address being hammered. In some embodiments, the remapped aggressor may also have a different data distribution and / or a different type of memory to further mitigate the row hammering effect.

[0019] Figure 1This is a block diagram of a memory system according to some embodiments of the present disclosure. The memory system 100 includes a controller 102 and a memory 104. The memory 104 includes a memory array 112 having a plurality of memory cells. Memory cells may be disposed at the intersection of word lines (WL, rows) and bit lines (digit lines, columns). The controller 102 is operable on the memory 104 to perform access operations on the memory cells. For example, the controller 102 may write data to a specified memory cell of the memory array 112 (as part of a write operation) and may read data from a specified memory cell of the memory array 112 (as part of a read operation).

[0020] The controller 102 can be coupled to the memory 104 via several buses. Figure 1 The diagram illustrates the data bus DQ and the command / address bus C / A. Controller 102 may include processor 106, which can operate memory 104 in part by providing commands and addresses along the C / A bus and sending and receiving data along the DQ bus. For example, as part of a write operation, processor 106 may provide a write command and address ADD specifying one or more memory cells along the C / A bus, and may provide write data along the DQ bus. Memory 104 may then store the data into the memory cell specified by address ADD. As part of an instance read operation, processor 106 may provide a read command and read address along the C / A bus, and may receive read data from the memory cell specified by the address along the DQ bus.

[0021] Addresses can be associated with different memory cells of memory array 112. For example, column address YADD can specify one or more numeric lines, row address XADD can specify one or more word lines, and bank address BADD can specify one or more banks of memory array 112. Processor 106 can be coupled to address map 108, which can specify which addresses are associated with which physical word lines WL of memory array 112. For example, address map 108 can indicate that a first value of row address XADD is associated with a first word line WL0, a second value of row address XADD is associated with a second word line WL1, and so on.

[0022] Controller 102 may include cache 110, which can be used to store information for fast access. Cache 110 may include a data storage structure for storing information. Cache 110 may have a higher access speed than memory 104. In some embodiments, cache 110 may include memory cells of a different type than the memory cells in memory 104. Cache 110 may store a collection of recently accessed data from memory 104. For example, data can be read from a word line, and the data can be stored in cache 110. Any subsequent access to the data may alternatively redirect to the data stored in cache 110. When more space is needed and the data is the oldest entry in cache 110, the data may leave the cache (any changes to the data in the cache may be written to memory 104). Cache 110 may include locking tags associated with entries in cache 110. Processor 106 may lock one or more entries in cache 110, in which case the data may remain in the cache until the lock is removed, even if the data is otherwise retrieved from the cache.

[0023] While cache 110 is generally referred to herein as a component of controller 102, in some embodiments, the cache may reside in memory 104 (e.g., replacing or supplementing the controller-side cache). It should be understood that various embodiments of the invention may also function in conjunction with a memory-side cache in a manner similar to that described with respect to a controller-side cache. For example, to apply a lock, controller 102 may provide a lock signal to the memory-side cache along a bus (e.g., a C / A bus).

[0024] Controller 102 may include row hammering (RH) logic 120. As part of an access operation, RH logic 120 may track row addresses provided to memory 104 to determine whether one or more rows are part of a (real or suspected) row hammering attack. Once RH logic 120 determines that one or more rows are involved in the attack, it may take one or more steps to mitigate the damage.

[0025] For example, RH logic 120 can identify a specific address of memory 104 associated with a row (e.g., a word line) of memory array 112. For example, the specific address could be an aggressor address and could be identified based on the number of accesses to the row exceeding a first threshold. RH logic 120 can also determine whether an address is a frequent aggressor based in part on whether the number of accesses to the row exceeds a second threshold (e.g., as determined by the same or different count values ​​used to track whether an address is an aggressor). In some embodiments, RH logic 120 can also determine whether an address is a high-attack address based in part on whether the number of accesses to the row exceeds a third threshold (e.g., as determined by the same or different count values ​​used to track whether an address is a frequent aggressor).

[0026] RH logic 120 may include RH detector 122. RH detector 122 may utilize one or more schemes to monitor access patterns to rows to determine whether they are aggressors (e.g., whether they are targets of an RH attack). Embodiments of this disclosure may use any type or combination of row hammer detection. As used herein, the term aggressor row may be used broadly to refer to a row that meets the criteria set forth by aggressor detector 122 to determine whether a row is an aggressor. Such aggressor rows do not need to actually harm neighboring rows (e.g., victim rows). Similarly, as used herein, the term victim row may refer to a row that has a defined relationship with the aggressor row (e.g., proximity, physical distance, etc.). Victim rows do not need to experience an actually increased rate of data decay.

[0027] In some embodiments, the RH detector 122 may monitor the number of address accesses and / or the access frequency. For example, the RH detector 122 may receive row addresses from the C / A bus and check whether the address is in an intruder memory structure. If not, the received address may be stored. If so, the received address may be determined to be an intruder. In some embodiments, if a match exists, a counter associated with the stored address may be updated, and once the counter exceeds a threshold, the received address may be determined to be an intruder. In some embodiments, instead of receiving each address from the C / A bus, sampling may be used. For example, the sampling signal may be activated by random timing, semi-random timing, pseudo-random timing, periodic timing, timing based on one or more other signals, or a combination thereof. When the sampling signal is activated, the next value of the address along the C / A bus may be received by the RH detector 122. In some embodiments, the RH detector 122 may check for row hammering events based on actual errors in the data read from the memory 104. For example, the memory may include error correction code (ECC) circuitry that checks for errors in the data. If an error is detected, it can be communicated to controller 102, which can then determine whether to read data from the victim row.

[0028] RH logic 120 may also include an RH tracker 124, which can be used to monitor the number (and / or frequency) of times certain addresses are identified as aggressors, the number of times representing the number (and / or frequency) of access to a particular address. For example, RH tracker 124 may include a first data storage structure 126 that can store addresses and count values. When RH detector 122 determines that an address is an aggressor, RH tracker 124 can compare the aggressor's value with the stored address. If a match is found, the count value associated with the stored address can be updated (e.g., incremented). If no match is found, RH tracker 124 can check to see if there is open space in the first data storage structure 126. If so, the address can be stored, and the count associated with the address can be initialized (e.g., set to an initial value, such as 0). In some embodiments, a timestamp associated with the address (not shown) can also be recorded. If no open space is found, RH tracker 124 can use one or more criteria to determine what has happened (e.g., the stored address with the lowest count can be replaced, the stored address with the oldest timestamp can be replaced, etc.).

[0029] RH tracker 124 monitors a count value in the first data storage structure 126. The count value can be compared to a first threshold (e.g., whenever one of the count values ​​is updated). When the count value exceeds the threshold, RH tracker 124 determines that the intruder address is a frequent intruder address and provides a lock signal to cache 110 (e.g., via processor 106). Cache 110 can lock the data associated with the frequent intruder row address. This keeps the data in cache 110, preventing subsequent access to memory 104 as long as the lock remains. Since data is no longer accessed in memory 104, access no longer hammers the word lines of memory 104. Controller 102 can use various criteria to determine when to release the lock. For example, the lock can be released after a certain period of time (e.g., several clock cycles). When data is retrieved from cache 110 (e.g., after the lock expires), if any changes have occurred to the data (e.g., via a write operation), the updated data can be written back from cache 110 to memory 104.

[0030] In some embodiments, the RH tracker 124 may also include a secondary data storage structure 128. While the use of cache locking can provide a way to mitigate hammer attacks over a period of time, in some cases, the attack can be so severe that a longer-term solution is required. The secondary data storage structure 128 can track the number of times a given address is identified as an aggressor address. For example, whenever the count in the first data storage structure 126 exceeds a threshold, the address can be provided to the secondary data storage structure 128. The secondary data storage structure 128 can operate in a manner similar to the primary data storage structure 126. Whenever an address is received, the address can be compared with an address already stored in the second data storage structure 128, and if a match is found, the count associated with the stored address can be changed (e.g., incremented). If the count exceeds a second threshold, it can indicate that the associated address is a high-attack address.

[0031] In some embodiments, instead of including a secondary data storage structure 128, the RH logic can use a first data storage structure 126 to identify high-attack addresses. For example, when the count in the first data storage structure 126 exceeds a first threshold, the associated address can be determined to be a frequent attacker address. The data storage structure 126 can continue to monitor the count value, and if the count value in the first data storage structure 126 exceeds a second threshold, then the associated address can be identified as a high-attack address. In such embodiments, the secondary data storage structure 128 can be omitted.

[0032] In response to determining that an address is a high-attack address, RH logic 120 may provide the high-attack address to processor 106. In some embodiments, RH logic 120 may also provide one or more additional signals indicating that the address is a high-attack address. Processor 106 may modify address mapping 108 based on the high-attack address. Address mapping 108 may allow processor 106 to determine where information is stored in memory array 112. Processor 106 may modify the high-attack address in address mapping 108 to mitigate and / or prevent row hammer attacks on the address.

[0033] Address mapping 108 may include mappings of virtual addresses. These virtual addresses are accessible to the operating system running on processor 106. Address mapping 108 may include physical address mappings, which instruct processor 106 how to generate physical address signals based on the virtual addresses accessed by the operating system. Address mapping 108 may include physical-to-device mappings, which indicate how physical addresses are actually distributed across the structure of memory array 112.

[0034] In some embodiments, in response to a high-attack address, processor 106 may change the physical address associated with the high-attack address. For example, the high-attack address may be row address XADD2 associated with word line WL2 in memory array 112. Processor 106 may change the physical address mapping such that address XADD2 is now associated with word line WL6, and data previously stored on word line WL2 may be copied to word line WL6 (and data on WL6 may be copied to WL2). This may move address XADD2 so that it accesses word lines away from its previous victims (e.g., WL1 and WL3). Addresses previously associated with replacement word line WL6 (e.g., XADD6) may be remapped in address mapping 108 so that they are now associated with word line WL2.

[0035] In some embodiments, memory 104 may include a first memory region (e.g., memory array 112) and a second memory region 113. The second memory region 113 may represent a different memory array or a portion of the same memory array. In some embodiments, address mapping 108 may be modified to remap high-attack addresses from the first region 112 to the second region 113. In some embodiments, the second memory region 113 may have different characteristics that make the information stored therein less susceptible to row hammering effects.

[0036] For example, the second memory segment 113 may contain memory cells of a different type than the main memory array 112. For example, the memory array 112 may contain memory cells of a first type (e.g., DRAM cells), while the second memory segment 113 may contain memory cells of a second type (e.g., SRAM, FeRAM, flash, etc.). In some embodiments, in response to a high-attack address, the processor 106 may change the address mapping 108 such that the high-attack address is remapped from a memory cell of the first type (e.g., in the memory array 112) to a memory cell of the second type (e.g., in the second memory segment 113).

[0037] In some embodiments, processor 106 may modify the physical-to-device mapping of high-attack addresses. Memory 104 may include a first segment 112 with a first type of physical-to-device mapping and a second segment 113 with a second type of physical-to-device mapping. High-attack addresses may be remapped from one segment to the other. For example, the first memory segment 112 may have striping of the first type, and the second memory segment 113 may have striping of the second type.

[0038] Figure 2This is a block diagram of a semiconductor device according to embodiments of the present disclosure. Semiconductor device 200 may be a semiconductor memory device, such as a DRAM device integrated on a single semiconductor chip. In some embodiments, semiconductor device 200 may be included in… Figure 1 In memory 104.

[0039] Semiconductor device 200 includes memory array 218 (e.g., Figure 1 (Memory array 112 and / or second memory region 113). Memory array 218 is shown as containing multiple memory banks. Figure 1 In one embodiment, memory array 218 is shown to include eight memory banks BANK0 to BANK7. Other embodiments of memory array 218 may include more or fewer memory banks. Each memory bank includes multiple word lines WL, multiple bit lines BL and / BL, and multiple memory cells MC arranged at the intersections of the multiple word lines WL and the multiple bit lines BL and / BL. The selection of word lines WL is performed by row decoder 208, and the selection of bit lines BL and / BL is performed by column decoder 210. Figure 1 In this embodiment, row decoder 208 includes a corresponding row decoder for each memory bank, and column decoder 210 includes a corresponding column decoder for each memory bank. Bit lines BL and / BL are coupled to corresponding sense amplifiers (SAMPs). Read data from bit lines BL or / BL is amplified by the sense amplifier SAMP and transmitted to read / write amplifier 220 via complementary local data line (LIOT / B), transmission gate (TG), and complementary main data line (MIOT / B). Conversely, write data output from read / write amplifier 220 is transmitted to the sense amplifier SAMP via complementary main data line MIOT / B, transmission gate TG, and complementary local data line LIOT / B, and written to the memory cell MC coupled to bit line BL or / BL.

[0040] The semiconductor device 200 may employ multiple external terminals, including: a command and address (C / A) terminal coupled to the command and address bus to receive commands and addresses; a CS signal clock terminal for receiving clock CK and / or CK; a data terminal DQ for providing data; and power supply terminals for receiving power supply potentials VDD, VSS, VDDQ, and VSSQ. A controller (e.g., Figure 1 102) can be coupled to various terminals via one or more buses in order to send various signals to or receive various signals from the memory device 200.

[0041] An external clock CK and / or CK is supplied to the clock terminal by the controller. The clock signal is provided to input circuit 212. The external clock may be complementary. Input circuit 212 generates an internal clock ICLK based on the CK and / or CK clocks. The ICLK clock is provided to command decoder 206 and to internal clock generator 214. Internal clock generator 214 provides various internal clocks LCLK based on the ICLK clock. The LCLK clock can be used for timing operations of various internal circuits. The internal data clock LCLK is provided to input / output circuit 222 to time the operation of circuits contained in input / output circuit 222, for example, to a data receiver to time the reception of written data.

[0042] The controller can supply memory addresses to the C / A terminals. The memory addresses supplied to the C / A terminals are transmitted to the address decoder 204 via the command / address input circuit 202. The address decoder 204 receives the address and supplies the decoded row address XADD to the row decoder 208 and the decoded column address YADD to the column decoder 210. The address decoder 204 can also supply a decoded bank address BADD, which indicates the bank of memory in the memory array 218 containing the decoded row address XADD and column address YADD. Commands can be supplied to the C / A terminals by the controller. Examples of commands include timing commands for controlling the timing of various operations, access commands for accessing memory (e.g., read commands for performing read operations and write commands for performing write operations), and other commands and operations. Access commands can be associated with one or more row addresses XADD, column addresses YADD, and bank addresses BADD to indicate the memory cell to be accessed.

[0043] Commands can be provided as internal command signals to command decoder 206 via command / address input circuitry 202. Command decoder 206 includes circuitry for decoding internal command signals to generate various internal signals and commands for performing operations. For example, command decoder 206 can provide row command signals for selecting word lines and column command signals for selecting bit lines.

[0044] Device 200 can receive access commands as read commands from a controller. When a read command is received and is promptly supplied to the bank address, row address, and column address, read data is read from the memory cells corresponding to the row and column addresses in memory array 218. The read command is received by command decoder 206, which provides an internal command to provide the read data from memory array 218 to read / write amplifier 220. The read data is output to the outside via input / output circuitry 222 from data terminal DQ.

[0045] Device 200 can receive access commands as write commands from a controller. When a write command is received and is supplied in a timely manner to the bank address, row address, and column address, write data supplied to the data terminal DQ is written to the memory cells in memory array 218 corresponding to the row and column addresses. The write command is received by command decoder 206, which provides an internal command to cause the write data to be received by the data receiver in input / output circuit 222. A write clock can also be provided to an external clock terminal for timing the reception of write data by the data receiver in input / output circuit 222. The write data is supplied to read / write amplifier 220 via input / output circuit 222 and then to memory array 218 via read / write amplifier 220 to be written into memory cell MC.

[0046] The device 200 may also receive commands from the controller to perform one or more refresh operations as part of a self-refresh mode. In some embodiments, the self-refresh mode command may be issued externally to the memory device 200 (e.g., via...). Figure 1 (Controller 102). In some embodiments, the self-refresh mode command can be generated periodically by components of the device. In some embodiments, the refresh signal AREF can also be activated when an external signal indicates a self-refresh entry command. The refresh signal AREF can be a pulse signal activated when the command decoder 206 receives a signal indicating entry into the self-refresh mode. The refresh signal AREF can be activated immediately after the command input and can thereafter be activated cyclically according to desired internal timing. The refresh signal AREF can be used to control the timing of the refresh operation during the self-refresh mode. Therefore, the refresh operation can continue automatically. The self-refresh exit command can stop the automatic activation of the refresh signal AREF and can return the device 200 to an idle state and / or resume other operations.

[0047] A refresh signal AREF is supplied to refresh control circuitry 216. Refresh control circuitry 216 supplies a refresh row address RXADD to row decoder 208, which refreshes one or more word lines WL indicated by the refresh row address RXADD. In some embodiments, refresh address RXADD may represent a single word line. In some embodiments, refresh address RXADD may represent multiple word lines, which may be refreshed sequentially or simultaneously by row decoder 208. In some embodiments, the number of word lines represented by refresh address RXADD may vary from one refresh address to another. Refresh control circuitry 216 can control the timing of the refresh operation and can generate and provide refresh address RXADD. Refresh control circuitry 216 can be controlled to change details of refresh address RXADD (e.g., how the refresh address is calculated, the timing of the refresh address, the number of word lines represented by the address), or it can operate based on internal logic.

[0048] The refresh control circuit 216 can selectively output a target refresh address (e.g., specifying one or more victim addresses based on the aggressor) or an auto-refresh address (e.g., from an auto-refresh address sequence) as the refresh address RXADD. Based on the type of the refresh address RXADD (and in some embodiments, one or more additional signals indicating the operation type), the line decoder 208 can perform a target refresh or auto-refresh operation. The auto-refresh address can be from an address sequence provided based on the activation of the refresh signal AREF. The refresh control circuit 216 can cycle through the auto-refresh address sequence at a rate determined by AREF. In some embodiments, the auto-refresh operation can typically occur at such a timing that the auto-refresh address sequence is cycled so that, for a given word line, no information degradation is expected during the time between auto-refresh operations. In other words, the auto-refresh operation can be performed such that each word line is refreshed at a rate faster than the expected information decay rate.

[0049] Power supply potentials VDD and VSS are supplied to the power supply terminals. These potentials VDD and VSS are then supplied to the internal voltage generator circuit 224. The internal voltage generator circuit 224 generates various internal potentials VPP, VOD, VARY, VPERI, etc., based on the power supply potentials VDD and VSS supplied to the power supply terminals. Internal potential VPP is primarily used in the line decoder 208, internal potentials VOD and VARY are primarily used in the sense amplifier SAMP contained in the memory array 218, and internal potential VPERI is used in many peripheral circuit blocks.

[0050] Power potentials VDDQ and VSSQ are also supplied to the power terminals. These power potentials VDDQ and VSSQ are supplied to the input / output circuit 222. In embodiments of this disclosure, the power potentials VDDQ and VSSQ supplied to the power terminals may be the same as the power potentials VDD and VSS supplied to the power terminals. In another embodiment of this disclosure, the power potentials VDDQ and VSSQ supplied to the power terminals may be different from the power potentials VDD and VSS supplied to the power terminals. The power potentials VDDQ and VSSQ supplied to the power terminals are used in the input / output circuit 222 to prevent power supply noise generated by the input / output circuit 222 from propagating to other circuit blocks.

[0051] Figure 3 This is a block diagram of row hammering logic according to some embodiments of the present disclosure. In some embodiments, row hammering logic 300 may be included in... Figure 1 The row hammering logic 120 is described. Row hammering logic 300 represents an embodiment of a counting-based scheme for intruder detector and RH tracker logic. Other methods for detecting intruder addresses and tracking the frequency (and / or number of times) intruders appear can be used in other example embodiments.

[0052] The hammer-on logic 300 includes an aggressor detector circuit 310 (e.g., Figure 1 The RH detector 122). The intruder detector circuit 310 includes a data storage structure that maintains several row addresses XADD and several counts associated with each of the stored row addresses XADD (and / or with one of the storage slots). The intruder detector circuit 310 also includes detector logic 312 that manages the information stored in the intruder storage structure.

[0053] The data storage structure can be organized into slots, each of which can store a row address (e.g., XADD0 to XADDi) and an associated count value (e.g., count 0 to count i). Each slot can contain several individual cells, each of which can store information bits. In some embodiments, the data storage structure may include content-addressable memory (CAM) cells that can provide a match signal if a provided comparison bit matches a stored bit.

[0054] Detector logic 312 can receive row address XADD from the row address bus. Row address XADD can be communicated with the controller (e.g., controller 102) and the memory (e.g., ...). Figure 1 The detector logic 312 is associated with the access operation performed by (104). The detector logic 312 can compare the received address with the stored addresses XADD0 to XADDi. If the received address matches one of the stored addresses, the count associated with the stored address can be changed (e.g., incremented). If no match is found, the detector logic 312 can store the received address XADD in the storage structure. For example, if an open slot exists in the data storage structure, the address XADD can be stored in the open slot. If no open slot exists, one or more criteria can be used to determine which of the stored addresses should be replaced (e.g., the stored address with the lowest count value). In some embodiments, when a new address is stored in the data storage structure, the count value can be reset to an initial value (e.g., 0). In some embodiments, if a new address replaces a previously stored address, the count value associated with the previously stored address can be maintained.

[0055] After updating the count value, detector logic 312 can compare the updated count value with a first threshold Thresh1. If the updated count value exceeds the threshold Thresh1 (or if it meets or exceeds the threshold Thresh1), then detector logic 312 can determine that the received row address XADD represents an aggressor address HitXADD. The aggressor address HitXADD can be provided to memory (and / or a signal indicating that the address is an aggressor can be provided), allowing memory to perform a target refresh operation on the victim word line associated with the aggressor address (e.g., HitXADD+1, HitXADD-1, HitXADD+2, HitXADD-2, etc.). In response to determining that the row address XADD and its stored corresponding portion are aggressors, detector logic 312 can change the count value associated with the aggressor address. For example, the count value can be reduced (e.g., by the threshold Thresh1) or reset (e.g., to 0). In some embodiments, the stored address can be cleared in response to the stored address being provided as the aggressor address HitXADD.

[0056] In some embodiments, the threshold Thresh1 may be inherent to the structure used to hold the count value. For example, the count may be stored as an N-bit number with 2^N possible states. The count value may be incremented whenever a match occurs. When it reaches its maximum value, it may be 'flipped' back to its initial value (e.g., 0). Detector logic 312 may interpret the flip as the count exceeding the threshold, and therefore, the maximum value of the count may serve as the threshold.

[0057] In some embodiments, the intruder detector circuit 310 may sample row addresses XADD from the row address bus, rather than receiving each row address XADD. Optional sampling timing circuitry 302 may provide a sampling timing signal ArmSample. When the sampling signal ArmSample is activated, detector logic 312 may capture the next value of XADD (e.g., provide the next time ACT). The sampling timing circuitry 302 may provide the signal ArmSample through random timing, semi-random timing, pseudo-random timing, periodic timing, timing based on one or more other signals (e.g., a count of ACT), or a combination thereof.

[0058] Other forms of intruder detection can be used in other example embodiments. For instance, instead of including a data storage structure and count values, the intruder detector circuit 310 can store addresses and can provide address XADD as the intruder address HitXADD if address XADD matches one of the stored addresses. In some embodiments, the intruder detector circuit 310 can provide any sampled address XADD as address HitXADD. Other intruder detection schemes can be used in other example embodiments.

[0059] The hammer-on logic 300 also includes a first tracker circuit 320 and a second tracker circuit 330 (e.g., respectively). Figure 1 (126 and 128). Tracker circuits 320 and 330 are generally similar to aggressor detector circuit 310, and therefore, for the sake of brevity, the features and operations already described with respect to aggressor detector circuit 310 will not be repeated for tracker circuits 320 and 330.

[0060] The first tracker circuit 320 receives the aggressor address HitXADD and determines whether the aggressor address HitXADD is a frequent aggressor address FreqHitXADD. The first tracker circuit 320 may store the received aggressor address HitXADD and an associated count value, and determines whether the address is a frequent aggressor address FreqHitXADD in part based on a comparison of the count value with a threshold Thresh2.

[0061] The identified frequent intruder address FreqHitXADD can be provided to the processor (and / or can provide a signal indicating that a frequent intruder has been located), and the processor can lock the data in the cache associated with the frequent intruder address. Since subsequent accesses to the data will be in the cache rather than in the memory array, this mitigates word line hammering in the memory array.

[0062] The second tracker circuit 330 can receive the frequent aggressor address FreqHitXADD and determine whether the frequent aggressor address FreqHitXADD is a high-attack address VHAXADD. The second tracker circuit 330 can store the received frequent aggressor address FreqHitXADD and the associated count value. The second tracker circuit 330 can determine whether the frequent aggressor address FreqHitXADD is a high-attack address VHAXADD in part based on a comparison of the associated count value with a threshold Thresh3.

[0063] The identified high-attack address VHAXADD can be provided to the processor (and / or a signal indicating that the high-attack address has been located), and the processor can change the address mapping to alter the word line associated with address VHAXADD. For example, address VHAXADD can be remapped to a different word line away from the word line originally associated with VHAXADD. In some embodiments, address VHAXADD can be remapped to a different segment of the memory array, which may be less susceptible to row hammering effects. For example, the new segment may have a different physical-to-device mapping (e.g., different stripes), may contain different types of memory cells, or combinations thereof.

[0064] In some embodiments, the second tracker circuit 330 may be omitted, and the hammering logic 300 may not detect high attack addresses.

[0065] In some embodiments, the second tracker circuit 330 may be omitted, and the first tracker circuit 320 may identify both the frequent aggressor address FreqHitXADD and the high-attack address VHAXADD. For example, tracker logic 322 may include two thresholds (e.g., Thresh2 and Thresh3). When the count value exceeds threshold Thresh2, address HitXADD can be determined to be the frequent aggressor FreqHitXADD, and the count value can be maintained. If the count value then exceeds the second threshold (e.g., Thresh3), then the address can be determined to be the high-attack address VHAXADD.

[0066] In some embodiments, tracker circuitry 320 and / or 330 may include a timestamp associated with each address and count value. When a new address is written to tracker 320 and / or 330, tracker logic 322 or 332 may write a timestamp indicating the time the entry was added, either in an open slot or by overwriting a previous entry. If no open slot exists, the entry with the oldest timestamp can be replaced with the new entry when a new entry needs to be added.

[0067] Figure 4 This is a block diagram of a cache and cache logic according to some embodiments of the present disclosure. In some embodiments, cache 402 may be included in... Figure 1 In the cache 110. In some embodiments, cache logic 404 may represent the processor (e.g., Figure 1 106) and / or controller (e.g., Figure 1 One or more operations of other logic circuits of (102).

[0068] Cache 402 may include a data storage structure that can temporarily store data retrieved from memory. For example, when the controller issues a read command to memory, the data retrieved as part of the read operation may be stored in cache 402. Subsequent access to the data may access the data stored in cache 402, rather than accessing word lines in memory. The data storage structure may include several slots, each of which can store data, and an address (Addr), a timestamp (Time), and a lock flag (Lock) associated with the data.

[0069] Cache logic 404 displays various components that manage the contents of cache 402. For example, read / write logic 406 determines whether data should be accessed from cache 402 or whether the data should be accessed from memory. Cache management logic 408 manages the entries in cache 402.

[0070] When data is retrieved from memory, cache management logic 408 may store the data stored in cache 402 along with a timestamp (Time) indicating the time the data was accessed. If cache 402 is full, cache management logic 408 may check the timestamps in cache 402 and may replace the data in cache 402 with the oldest timestamp. When data is added to the cache, R / W logic 406 may indicate that access to the address associated with the data should be redirected to cache 402 instead of memory.

[0071] For example, a read operation can be performed by receiving an address. R / W logic 406 can check the address (and / or address mapping indicating data is in the cache) against an address in cache 402, and can read the data associated with that address from cache 402. Similarly, a write operation can be performed by writing information into an entry in cache 402. When data leaves cache 402, R / W logic 406 can determine whether any changes have been made to the data in cache 402 (e.g., due to a write operation), and can write the changed data back to memory.

[0072] Cache logic 404 may include locking logic 410, which manages locking operations in cache 402. For example, each slot in cache 402 may contain a locking flag. In some implementations, the locking flag may be a single bit, which may be active to indicate that an entry in the slot is locked, and inactive to indicate that an entry in the slot is not locked. When a particular slot is locked, the normal criteria for removing entries from cache 402 may be overridden, and the locked entry may remain in cache 402. For example, when a new entry is received and there are no open slots in cache 402, cache management logic 408 may check the timestamp and locate the slot associated with the oldest timestamp. However, if the locking flag of the slot is active (e.g., data is locked in the cache), then cache management logic 408 may proceed to the slot with the next oldest timestamp that has an inactive locking flag.

[0073] Locking logic 410 can use various criteria to determine when to activate a lock flag for a given entry and when to deactivate the active lock flag. For example, in response to receiving a frequent attacker address FreqHitXADD, locking logic 410 can activate a lock flag in the cache slot associated with the frequent attacker address FreqHitXADD. Locking logic 410 may include a timer and can keep the entry associated with FreqHitXADD locked for at least a set period of time. Once the timer indicates that a certain amount of time has elapsed (e.g., based on a comparison of the current time with the timestamp associated with the entry), locking logic 410 can deactivate the lock associated with the entry.

[0074] Figure 5 This is a block diagram of a method according to some embodiments of the present disclosure. In some embodiments, method 500 may be implemented as described herein (e.g., Figures 1 to 4 On one or more devices or systems. Method 500 illustrates a particular step arrangement; however, other step arrangements may be used in other embodiments.

[0075] Method 500 may typically begin with box 505, and its description includes, for example, identifying a row of memory associated with a specific address by determining whether the address is an intruder address. The address may be part of an access operation performed by a controller on the memory. The controller (e.g., Figure 1 (102) Addresses and commands can be provided to memory along the command address (C / A) bus. Addresses can specify one or more organizational levels of the memory. For example, a row address can specify one or more rows (word lines) of the memory.

[0076] The controller can use one or more criteria to determine whether an address is an intruder address. Any scheme or combination of schemes for detecting intruder addresses can be used. For example, the controller can monitor the number of times a given address is provided, the frequency of access to the address, or a combination thereof. In some embodiments, the controller can use error tracking to determine when an address is an intruder address.

[0077] Box 505 is typically followed by box 510, which describes determining whether an intruder address is a frequent intruder address. The controller can monitor the number and / or frequency of intruder addresses identified (e.g., the number and / or frequency of accesses to rows associated with the intruder address), and then determine whether the intruder address is a frequent intruder address based on the number and / or frequency. Box 510 illustrates a specific implementation of how to determine whether an intruder is a frequent intruder address (e.g., boxes 515 through 535); however, other implementations may be used in other embodiments.

[0078] Box 515 describes comparing a specific address (e.g., an aggressor) with multiple stored addresses, and changing a count value in part based on said comparison. For example, Box 515 may describe determining whether an aggressor address exists in a line hammer (RH) tracker circuit (e.g., Figure 1 In section 124). The RH tracker circuit may contain data structures (e.g., Figure 1 (126), which can store the aggressor's address and various other information associated with the aggressor's address. The aggressor's address can be compared with addresses already stored in the data storage structure.

[0079] If a match is found, the method proceeds to box 520, which describes storing the aggressor address in the RH tracker circuitry. For example, if an open slot exists in the data storage structure, the aggressor address can be stored, and a count value associated with the aggressor address can be initialized. In some embodiments, a timestamp indicating the time the aggressor address was stored can be stored. If no open slot exists in the data storage structure, an existing entry can be overwritten. For example, the entry with the lowest count value or the oldest timestamp can be overwritten.

[0080] If a match exists between the aggressor address and one of the stored addresses, then box 515 can be followed by box 525, which describes changing the count value associated with the stored aggressor address. For example, the count value can be incremented.

[0081] Box 525 is typically followed by box 530, which describes determining, in part, whether a row of memory (associated with the attacker's address) has been accessed at least a threshold number of times based on a count value. For example, box 530 might describe determining whether the count value is greater than a first threshold. If the count value is not greater than the threshold, then it can be determined that the attacker is not a frequent attacker address, and method 500 can return to box 505. If the count value is greater than the threshold, then it can be determined that the attacker address is a frequent attacker address, and box 530 might be followed by box 535.

[0082] Box 535 describes managing cache entries associated with specific addresses in part based on determining that a row of memory has been accessed at least a threshold number of times. For example, Box 535 may describe locking cache entries associated with frequently accessed addresses. For example, cache logic may activate a locking flag associated with a cache entry. While the locking flag is active, data may remain in the cache, which may override other criteria used to determine when data leaves the cache. Method 500 may include deactivating the locking flag after a set time following activation.

[0083] Method 500 may include retrieving data from a memory array and storing the data in a cache (which may be part of the memory or part of a controller). While the data is in the cache, method 500 may include directing access to the data to the cache, rather than to the memory array. Method 500 may include retrieving data from the cache, which may include writing the retrieved data back to memory. Method 500 may include preventing data retrieval when a locking flag associated with the data is active.

[0084] If the intruder address is determined to be a frequent intruder address, then box 510 can typically be followed by box 540. Box 540 describes determining whether a frequent intruder address is a high-attack address. Method 500 may include tracking the number and / or frequency of times a given address is identified as a frequent intruder address, and then determining whether the frequent intruder address is a high-attack address based on the number and / or frequency. For example, box 540 may describe determining whether a row of memory has been accessed at least a second threshold number of times.

[0085] Various methods can be used to determine whether a frequently aggressor address is a high-attack address. For example, in a manner similar to the methods described in boxes 515 to 530, the RH tracker circuitry may include a second data structure (e.g., Figure 1 (128), which can store frequent addresses and various other information associated with frequent aggressor addresses. The count value can be changed based on the comparison between the frequent aggressor address and the stored frequent aggressor addresses, and the comparison of the count with a second threshold can determine whether the frequent aggressor address is a high-attack address.

[0086] If the frequent attacker address is not a high-attack address, the method may return to box 505. If the frequent attacker address is determined to be a high-attack address, then box 540 may typically be followed by box 545, which describes the remapping of the high-attack address. For example, method 500 may include remapping the high-attack address from a first memory region with stripes of a first type to a second memory region with stripes of a second type.

[0087] As used herein, signal activation can refer to any portion of the signal waveform in which a circuit responds. For example, if a circuit responds to a rising edge, then a signal switching from a low level to a high level can be considered activated. One type of activation is a pulse, where a signal switches from a low level to a high level for a period of time and then returns to a low level. This can trigger circuitry that responds to rising edges, falling edges, and / or signals at high logic levels. Those skilled in the art will understand that while embodiments of a particular type of activation (e.g., active high) used by a particular circuit can be described, other embodiments may use other types of activation (e.g., active low).

[0088] Of course, it should be understood that any of the examples, embodiments, or processes described herein may be combined with or separated from one or more other examples, embodiments, and / or processes and / or performed in a separate device or device portion of a system, apparatus, or method according to the present invention.

[0089] Finally, the foregoing discussion is intended to illustrate the system of the invention only and should not be construed as limiting the appended claims to any particular embodiment or group of embodiments. Therefore, while the system of the invention has been described in detail with reference to exemplary embodiments, it should be understood that numerous modifications and alternative embodiments can be devised by those skilled in the art without departing from the broader and established spirit and scope of the system of the invention as set forth in the appended claims. Therefore, the specification and drawings should be viewed in an illustrative manner and are not intended to limit the scope of the appended claims.

Claims

1. A memory controller device, comprising: A processor configured to provide an address to memory and receive data associated with the address; The logic is configured to identify the row of the memory associated with the address, change the count value associated with the address, and determine, based on the count value, that the row of the memory associated with the address has been activated at least a threshold number of times. as well as A cache configured to store data associated with the address, and configured to manage the data stored in the cache at least in part based on the row having been activated at least the threshold number of times.

2. The memory controller device of claim 1, wherein the logic is further configured to identify the row of the memory in part based on determination that the row of the memory associated with the address has been activated at least a second threshold number of times, wherein the second threshold number is less than the threshold number.

3. The memory controller device of claim 1, wherein the cache is configured to retrieve data from the cache based on one or more criteria, and wherein the cache manages the stored data by preventing the retrieval of the stored data, at least in part based on the row having been activated at least the threshold number of times.

4. The memory controller device of claim 3, wherein the cache is configured to prevent the retrieval of the stored data for at least a predetermined time period.

5. The memory controller device of claim 1, wherein the logic is further configured to determine whether the row of the memory associated with the address has been activated at least a second threshold number of times, and when the address has been activated at least the second threshold number of times, associate the address with a second row instead of the row.

6. The memory controller device of claim 5, wherein the logic is further configured to change a second count value, and wherein the logic is configured to determine, at least in part, based on the second count value, whether the row of the memory associated with the address has been activated at least a second threshold number of times.

7. The memory controller device of claim 5, wherein the row comprises memory cells of a first type, and wherein the second row comprises memory cells of a second type different from the memory cells of the first type.

8. A memory system comprising: Memory; as well as A controller configured to operate the memory, the controller comprising: A processor configured to provide addresses as part of an access operation; Logic configured to identify a row of the memory associated with the address and change a count value associated with the address, and based on the count value determine that the row of the memory associated with the address has been activated at least a threshold number of times; and A cache configured to store data associated with the address retrieved from the memory, and configured to manage the data stored in the cache at least in part based on the row having been activated at least the threshold number of times.

9. The memory system of claim 8, wherein the logic is configured to identify the row of the memory associated with the address based at least in part on the row having been activated at least a second threshold number of times.

10. The memory system of claim 8, wherein the cache is configured to manage the stored data by maintaining the stored data in the cache for at least a set amount of time.

11. The memory system of claim 8, wherein the logic is further configured to determine whether the row of the memory associated with the address has been activated at least a second threshold number of times, and wherein the address is associated with a second row, rather than with the row, based at least in part on the row having been activated at least the second threshold number of times.

12. The memory system of claim 11, wherein the memory comprises a first region and a second region, and wherein the row is located in the first region and the second row is located in the second region.

13. The memory system of claim 12, wherein the first region comprises stripes of a first type, and wherein the second region comprises stripes of a second type.

14. The memory system of claim 12, wherein the first region comprises memory cells of a first type and the second region comprises memory cells of a second type.

15. A method for performing memory controller operations, comprising: Identify the rows of memory associated with the address; The address is compared with multiple stored addresses, and the count value is changed in part based on the comparison; Whether the row of the memory has been accessed at least a threshold number of times is determined in part based on the count value; as well as The cache entries associated with the address are managed in part based on the determination that the row of the memory has been accessed at least the threshold number of times.

16. The method of claim 15, further comprising: Determine whether the row of the memory has been accessed at least a second threshold number of times; as well as Change the address's relevance to the second row of the memory.

17. The method of claim 16, further comprising: The address is compared with a second plurality of stored addresses, and a second count value is changed in part based on the comparison; as well as Whether the row of the memory has been accessed at least the second threshold number is determined in part based on the second count value.

18. The method of claim 16, further comprising: The count value is compared with a first threshold to determine whether the memory has been accessed at least the threshold number of times; as well as The count value is compared with a second threshold to determine whether the memory has been accessed at least the second threshold number of times.

19. The method of claim 16, further comprising changing the correlation of the address from a first memory region to a second memory region.

20. The method of claim 15, further comprising managing the cache entries by maintaining data associated with the address in the cache for at least a set amount of time.

Images